Ccl legal news issue 11 by CCL Group

CONSULTING

DIGITAL FORENSICS

E-DISCLOSURE

LEGAL NEWS Issue 11

www.cclgroupltd.com

IN THIS

A LOOK BACK AT 2013 & CCL’S VIEW ON WHAT WE CAN EXPECT IN 2014

EDITIO N...

> Roun dup of 2 013 and look tow a ards 201 4 > Thou ghts for the mon > E-Dis th closure: m anual vs. automate d > The R eal CSI: Sat nav forensics > CPD: Stop the madnes > Abou s t CCL > CPD course

by Umar Yasin From Jackson to divorcing oligarchs The general consensus does seem to be that the current exemption from costs budgeting for certain cases will be lifted. All civil courts are already affected by the changes to the overriding objective, with the focus now firmly on proportionality. But it does seem to be a widely-held belief that all commercial disputes, regardless of the exact court that they are being litigated in, will also be hit by the double-whammy of proportionality and costs budgeting, as the last-minute exemption to costs budgeting will be removed in 2014.

be expected, as this case was seen as key in how strict an approach the courts would take to non-compliance post-Jackson, so a decision to grant relief from sanctions in this case would have led to, as Lord Dyson said, ‘uncertainty and complexity and stimulate satellite litigation.’ What this is now going to mean for litigators is an increased focus on compliance with the new regime and very little room for manoeuvre when it comes to relief from sanctions. This is also likely to increase instances of tactical considerations and budget brinksmanship, as litigators use strict compliance and sanctions as a tactical tool.

The eagerly awaited decision from the Court of Appeal in the Mitchell case was as most lawyers anticipated, with the sanctions being upheld. Lord Dyson, Master of the Rolls, said he hoped the decision would ‘send out a clear message. If it does, we are confident that, in time, legal representatives will become more efficient and will routinely comply with rules, practice directions and orders.’ This strong stance was to

We are also going to see the same fairly consistent and rigid enforcement of the new Rules, with the courts continuing to exercise their case and costs management powers actively. We are also going to see parties continue to fall foul of the new regime and be refused relief from sanctions. Certain corporate clients will exert increasing influence over the way e-disclosure exercises are conducted, particularly in relation to the initial

collection of documents. Therefore the interplay between effective e-disclosure procedures and good information governance will be much more apparent as corporate clients of all sizes become increasingly cognisant about how they can best manage, preserve and, when necessary, collect and interrogate the ever-growing volumes of electronic data that they create. Whether it is a high-flying banker or fund manager, or a globetrotting oligarch or sheikh, something that is bound to continue and become more commonplace in 2014, is the use of digital forensics in high-value matrimonial disputes. Where there are suspicions that a spouse has taken steps to conceal or dissipate assets, and whether the digital forensics exercise is to try and assist with either tracing the actual assets or evidencing concealment, this is something that we at CCL saw more and more of during 2013 and it is a trend that we expect to see throughout 2014. Continued on page 3…

PETER WILLIAMS, Senior Analyst As a member of CCL’s computer forensics and e-disclosure laboratory, Peter is an experienced analyst who currently specialises in the collection and acquisition of data from business systems, often performed to tight legal deadlines, which requires quick and decisive action to ensure a thorough yet proportionate approach is adopted. Peter joined CCL in June 2013 and brings with him five years of experience in collecting, examining and presenting digital evidence for use in criminal investigations, civil litigation and corporate investigations. Peter holds a degree in Computing, an MSc in Forensic Information Technology, is trained in the major computer forensics and e-disclosure tools, and has given evidence as an expert witness in court.

Peter’s thoughts for the month Targeted collections: In the post-Jackson world of e-disclosure much is said about proportionality. However, it is difficult to turn the requirements of e-disclosure into a workable technical solution, when you must balance budgets and tight deadlines with ever-growing data volumes and confidentiality concerns over the blanket collection of data. One way to save time, money and address confidentiality issues is to perform a targeted collection on-site. In a recent case our client had six weeks to respond to a letter before action. This proved particularly challenging, as they had identified that relevant data would exist across several business systems and apply to approximately 20 past and present employees over a seven year period. Confidentiality was of paramount concern as these employees had all worked on many different projects, the majority of which were unrelated to this matter. I collected over 200GB of data from various systems; using the latest computer forensics and e-disclosure tools, I processed and indexed this data on-site. I then consulted with the client on how to reduce the data whilst still ensuring proportionate disclosure. This involved applying date range filters, appropriate keyword searches and excluding known irrelevant parties. I left the client with just 30GB of data. This approach saved the client considerable time and money, as processing time was reduced and review platform load charges slashed significantly, meaning the review team had far fewer items to review in the short timescale available to them.

TERESA DEEMING, Deputy Quality Manager Teresa started her working life in retail management for a well-known department store, then spent a couple of years at a building society before taking on the role of Sales Office Supervisor for a computer company producing, amongst other things, modems that were as big as wardrobes! Before joining CCL six years ago, Teresa had been employed for a number of years at a local college as PA to the Head of Curriculum, setting up a number of systems and processes to ensure the smooth running of departments. Teresa first joined CCL as Projects Administrator for the IT consultancy division of the business. She then took on the role of Office and Administration Manager before moving into her current position of Deputy Quality Manager for the entire CCL Group. Teresa now enjoys a very diverse role with responsibilities across all CCL Group divisions, including consultancy, forensics and e-disclosure.

Teresa’s thoughts for the month ‘We are what we repeatedly do. Excellence, then, is not an act, but a habit.’ (Aristotle – Ancient Greek Philosopher, Scientist and Physician, 384 BC-322 BC) The above description is very much on par with the service offered by CCL. Both the forensics and IT consultancy divisions of CCL are certificated to ISO 9001:2008 and their Quality Management Systems ensure that continuity of quality is followed by all staff across all projects. This is achieved from the very start of a project, when a very clear proposal will be presented to a client for approval. The project will then be managed and monitored closely to achieve the expected outcome efficiently and on time. Any issues are dealt with swiftly and as a priority, and customer feedback is sought as an aid to improve our processes and procedures. We have recently undergone a three year audit for ISO 9001:2008 and both the forensics and IT consultancy divisions of CCL achieved recertification and praise for their Quality Management Systems. CCL-Forensics Ltd is also accredited to the ISO 17025 standard for computer, mobile phone and sat nav analysis. It is the adherence to the Quality Procedures and Standard Operating Procedures in place, which all staff are aware of and work to, and the continual monitoring and auditing of these procedures which enables CCL to maintain the excellent quality of service that it has become known for. The result of this can be seen not only from the number of new clients that engage CCL, but also from the number of clients we have established and maintained relationships with over many years.

Continued from page 1…

From LIBOR to DPAs If there was one type of case that seemed to dominate 2013 it was those with a financial services element, ranging from misselling litigation to regulatory and enforcement type issues. The whole financial services sector is undoubtedly going to remain a key and fertile area of focus, with everything from swaps to benchmark manipulation still swirling through the system well into 2014. This will mean much more voice and chat data forming a core part of e-disclosure exercises in most cases with a financial services flavour. 2014 will also see deferred prosecution agreements becoming a reality in the UK and regulatory lawyers everywhere will be keenly awaiting further details from the SFO on DPAs. With the hope that this will lead to a rise in the number of internal investigations and encourage self-reporting by corporates, 2014 will also be the year that regulatory lawyers will expect to really start to see the effects of the Bribery Act. Corporates that are more at risk, either due to the location or industry in which they operate, will continue to invest in and improve how internal investigations are conducted.

Tweets and clouds Apart from the influx of either financial services litigation or financial regulatory cases that we at CCL saw in 2013, one of the most common instructions throughout the year has been employee-related issues. These have ranged from restrictive covenant breaches and misfeasance claims against directors, to employee fraud and IP theft. However, one of the main reasons behind the rise in CCL being instructed directly by corporates has been the ever-increasing ways in which employees have either communicated, colluded or acted using electronic methods. When it comes to internal investigations and computer forensics, even some of the most self-sufficient corporates have found themselves needing to speak to someone at CCL, because the device is not the usual laptop or desktop but the latest smartphone or tablet.

CASE STUDY Malware investigation – computer forensics THE CASE: CCL was asked to assist in a case regarding the possession of indecent images. The suspect had bee n charged with the possession of a small number of these images. The suspect claimed in his defence that he had never seen the images before and that they must have been produced by a third party, specifically a virus or Trojan. Malicious software had in fac t been found on the suspect’s computer, however the client needed CCL’s skills to investigate this further and rebut his defence. WHAT CCL DID: CCL’s analyst was able to analyse the viruses found in this case and, through a process of collecting and analysing system information , live analysis, behavioural analysis, identification of intrusion vectors and partial code disassembly, was able to establish that the viruses cou ld not have had any part to pla y in the creation of the images in question. THE OUTCOME: The analyst’s findings were accepted by the defence’s ow n computer expert and this led to the suspect changing his plea.

In other cases, corporates have come to us because the information they seek is being held in the cloud or sent via the latest peer-to-peer messaging application. Or perhaps it is because the key method of communicating has not been email but Twitter or LinkedIn. This means that in 2014 we expect that in-house teams are increasingly likely to use outside specialist providers for the more esoteric devices or methods of communication, just as search and seizure orders are more likely to cover iPads as well as laptops.

E-DISCLOSURE: THE COST OF DOING IT MANUALLY It is a fairly commonly occurring conversation that we have with our clients; ‘why do we need to use a third party to assist us with e-disclosure?’ In some cases it is the volume of data that drives this requirement; there is simply too much data to be handled by ‘traditional processes’. In some cases it is the complexity of the data that needs to be searched and disclosed that means it cannot be accessed without specialist tools. In some cases it is the nature of the proceedings that gives rise to a requirement for the processes to be defensible. But in some cases, the answer is actually ‘you dont’; where the case is sufficiently small either in terms of the data volumes or the quantum, engaging a third party may be overkill.

Since the Jackson Reforms in April 2013 we are seeing more and more cases falling into the ‘grey area’, multi-track cases of a size for which an internally driven e-disclosure exercise would be uncomfortable but not impossible. Often in these cases an assumption is made that to engage a third party to undertake the exercise would be prohibitively expensive. In the last issue of Legal News we explored the risks of an in-house e-disclosure exercise. In this article I explain how engaging a third party in these situations is not prohibitively expensive, but in some cases actually cheaper than attempting to do it in-house.

Example scenario Let’s take an example requirement of needing to identify and disclose documents from a number of individuals’ email accounts and documents stored on a central file share. At this point we have a choice and we tend to see projects taking one of two routes:

Approach A - manual The client themselves does an initial search, with each user identifying emails relevant to the matter. Files from the file server are also identified by the client and copies of these are made. All of the collated documentation is printed and provided to the instructed law firm in lever arch files for review.

Approach B - automated A third party provider is engaged who takes copies of all of the relevant mailboxes and a full copy of the file share. Potentially relevant documents are identified by keyword searches. 4

OVER AN AUTOMATED EXERCISE by Rob Savage The output of both of these exercises is a set of documents for review by the law firm. The difference at this stage is the format in which the law firm receives the documentation. The output of approach A is hard copy documentation in lever arch files and with approach B the output is access to an online e-disclosure platform. At this point approach A has incurred less cost than approach B, as the client has done most of the work themselves. Of course approach B has required the services of a third party, plus the additional costs associated with loading and processing data in the e-disclosure platform. The process of review is much the same for both. Typically a junior resource will work their way through the documents one by one, deciding for each whether the document is relevant and disclosable, irrelevant or privileged. With regards to hard copy we would expect a junior lawyer to review somewhere in the region of 1.5 - 2 lever arch files. This amounts to roughly 200-250 documents. The rate of review using an e-disclosure platform is generally higher; we tend to see reviewers coding 200-400 documents per day, depending on the level of experience and complexity of review. The reason why review tends to be quicker is because it is possible to highlight keywords in the documents being reviewed, allowing reviewers to quickly determine relevance. Another disadvantage of a manual review is the inability to de-duplicate the data. If, for example, we had five mailboxes, it is likely that there will be exact duplicates of emails that exist in more than one. A reviewer will find themselves reviewing the same document multiple times, wasting time and effort. We have in the past seen de-duplication reduce reviewable volumes by 30-40%. Once a final set of documents has been identified a disclosure list needs to be compiled. For the manual approach this can be a time-consuming exercise; manually identifying and compiling information about the documents in your set. If the documents have been coded using a review platform this list can be compiled in two or three hours, saving significant time. Overall we see the time saved in using a third party provider measured in days, with the amount of time being saved increasing with the volume of data. Cost is often an objection to employing the services of a third party e-disclosure provider, however, in some cases using a purpose-built review platform can reduce both the cost and turnaround time required for a disclosure exercise, not to mention removing a lot of the risks associated with a manual approach. For more information please call 01789 261200 or email edisclosure@cclgroupltd.com

THE REAL CSI: SAT NAV FORENSICS by Sarah Turner Picture the scene: 16:34 on a hazy Miami afternoon. With the hum of the city traffic in the background, the Lieutenant - shades on, watches through the rear view mirror of his SUV. One of his plain-clothed officers, crouching by the side of the fraudster’s hummer, quickly opens the passenger door while the suspect buys cigarettes in the local gas station.

Let’s find out where you’ve been then… He whispers as he quickly reaches into the glove box and takes out a small sat nav unit. He then sprints over to the getaway vehicle, where the Lieutenant is waiting with the engine running. The pair speed off in the SUV moments before the fraudster saunters out of the gas station towards his vehicle, blissfully unaware of what has just happened.

Let’s get it back to the lab… 17:31, back at the modern, glass-partitioned office in Miami. The uber-cool Lieutenant leans over as his Technical Specialist turns on the device and plugs it into his computer. A map of Miami lights up the large touchscreen monitor, with red dots indicating the most recent locations where a GPS fix has been recorded on the device. The officer touches one of the red dots on the screen and the camera swoops over the city quickly zooming in on an old factory building in downtown Miami, one of the latest GPS fixes recorded by the sat nav. A box pops up showing that this has been a regular recorded location over the past few weeks. The Lieutenant’s team of officers move in to start their surveillance… GPS technology is often used in cop dramas to help them home in on their suspects. However, GPS technology such as sat nav devices, can provide a lot more information than just the recent movements of a user, and so are a great source of intelligence for a variety of matters. And as entertaining and slick as this Hollywood depiction of sat nav analysis is, there are a few things the team in Miami are missing. Firstly, as with computer and mobile phone forensics, when investigating a sat nav device, it is important not to switch the device on. In fact, at CCL the entire examination of a sat nav device is conducted in a Faraday box, to prevent the device from picking up new GPS fixes. This minimises the risk of altering or overwriting the data stored on the device. So our friends in Miami are making a crucial mistake here, which could adversely affect any potential court case.

As shown in the story above, forensic analysis of sat nav equipment can reveal details of recent GPS fixes recorded by the device, depending on the make and model. But it can also provide additional information, such as stored ‘favourites’, journey plans and even deleted and archived information, which can be crucial in establishing facts to aid an investigation. For example, in one case CCL’s analyst was able to find archived trip logs dating back seven months, which was useful in building a bigger picture of the user’s day-to-day activities. This data was easy to miss, as it was not picked up by the standard commercial forensic tools. However, CCL has broad experience in the analysis of a wide range of sat nav devices and their file structures, and so was able to identify the archive files as containing potentially valuable data. In contrast to the activities of our friends in Miami, sat nav data can not only provide information on where the user has been, but can also help in establishing locations that the user has expressed an interest in, but not necessarily visited – e.g. ‘points of interest’ that have been programmed into the device. This can provide useful intelligence on a user’s planned activities, which the team in Miami would not get from their activity of merely looking at the recent GPS fixes. There can be a lot of useful data stored on a sat nav device, depending on the make and model. This ranges from GPS fixes, track logs, recently set destinations, saved favourites and archived data, to contacts, calls and SMS from paired mobile phones. However, care must be taken over the use of that data – for example, the difference between a track log or GPS fix, which is a guarantee of location and data such as recent destinations and saved favourites, which only indicate interest in a location, and cannot be relied upon to conclusively show where an individual was at a given date and time. Also, the use of GPS technology is no longer confined to simple carwindscreen sat nav units; most smart phones now come with GPS built in – for use with sat nav/GPS applications or other location-specific functions. This provides more opportunities for investigating the location of a user at a given date and time, which can provide crucial evidence to support a case.

For more information about sat nav forensics or CCL’s other products and services please visit www.cclgroupltd.com or call 01789 261200.

CPD - STOP THE MADNESS CPD courses are available all year round!

Employment Law

Everyone is guilty of the last-minute dash for CPD points. By the time October arrives, CPD mayhem and madness is upon us all.

Introduction to digital forensics

With the New Year fast approaching, why not make a resolution to get ahead of the game this year?

• Computer misuse • Internal fraud • BYOD Electronic evidence and internal investigations

CCL runs a number of CPD courses for lawyers all year round. We are flexible on course topics, location and delivery method. So instead of a last-minute mad dash in October, why not plan some courses throughout the year? CCL can offer courses either at your premises, subject to a minimum number of attendees, or at our premises in Stratford-upon-Avon, or even through an online webinar. Below is a list of some of our most popular courses:

General Introduction to electronic disclosure and digital forensics • • • •

Data in business Sources of data Digital forensics and e-disclosure Case studies

• Internal investigations • Regulatory investigations • Real-life case studies Intellectual property theft and digital forensics • Search and seizure orders • BYOD • The cloud and social media

One to three CPD hours are available. Courses can be tailored, specific to company needs. For more information please contact cpd@cclgroupltd.com or call 01789 261200.

Commercial Litigators Electronic evidence and e-disclosure • Practice direction 31B • Electronic Documents Questionnaire • Controlling costs E-disclosure and predictive coding/technology assisted review • Using predictive coding as a prioritisation tool • Benefits of predictive coding over paralegals • How predictive coding ties into proportionality and Jackson E-disclosure and financial litigation • Data sources: knowing where to look • What regulators expect • The role of a forensic accountant

CASE STUDY Terrorism – computer analysis THE CASE: A man suspecte d of being involved in terrorist activity was ide ntified by police and subsequently arrested. WHAT CCL DID: The sus pect’s home computer was examined by CCL and incriminating evidence was found. This included a number of emails as well as internet history, which showed that the accused had visite d a number of extreme religious and terror ism websites. THE OUTCOME: The data that CCL was able to extract from the sus pect’s computer provided crucial evidence for the police to arrest the suspect.

ABOUT CCL

CPD COURSE e c n e d i v e c i n o r t ‘Elec ’ e r u s o l c s i d e d an .

CCL is the UK’s largest digital forensics laboratory, and a leading provider of e-disclosure and IT consultancy services. From our beginnings as an independent IT consultancy in 1986, we have developed our services to respond to advances in new technology, the increasing importance of data, and the need to manage, recover and protect it. In 2001, we setup our digital forensics laboratory. CCL is now the largest digital forensics provider in the UK, and the only one accredited to the ISO17025 standard for our computer, mobile phone and Sat Nav laboratories. We provide digital forensics services to a broad range of organisations, ranging from law enforcement agencies, civil and criminal law firms to corporate clients.

rs urses for lawye co D P C s e d vi CCL pro to know thing you need ry ve e r ve co se sure of The nce and disclo e d vi e ic n ro ct about ele n. ored informatio electronically st ur CPD ouse counsel, o -h in r u o y b d re Delive nding of you an understa e iv g ill w e rs ns for you u co d its implicatio an ce n e d vi e ic electron . and your clients isclosure’ dence and e-d vi e ic n ro ct le ‘e CCL’s nce and course covers: lectronic evide e to n io ct u d o • Intr e-disclosure Q 31B and the ED n io ct e ir D e ic • Pract costs • Controlling chniques • Tools and te • Key cases

CCL has been in the e-disclosure market since 2009 and to date, has completed over 200 e-disclosure cases.

OUR SERVICES • Part 31 e-disclosure services

Missed an issue of Legal News? Don’t worry, all issues are available on our website at

Scan the QR code with your smartphone for more content.

www.cclgroupltd.com

• Digital forensics - All operating systems - Smartphones/mobile phones - Tablets - Sat Nav analysis - Cell site analysis - CCTV analysis • Collections • Part 25 search and seizure orders

COMING UP NEXT MONTH: Jackson has teeth Big data and ED

For more information call Rob or Umar on

01789 261200

email edisclosure@cclgroupltd.com or visit: www.cclgroupltd.com

• Part 35 expert witness services

THE NUMBERS CCL employs over 100 full-time members of staff, including 65 consultants and analysts who have completed: • 200+

e-disclosure cases

• 4,000+

digital forensic (PC) cases

• 50,000+ mobile phone cases • 2,000+

consultancy engagements

• 700+

civil and criminal cases

• 450+

expert witness assignments